@matterailab/orbcode 0.1.8 → 0.1.13

package/dist/ui/App.js

@@ -6,12 +6,13 @@ import { COLORS, VERSION } from "../branding.js";
 import { AXON_MODELS, getModel, isValidAxonModel } from "../api/models.js";
 import { LoginView } from "./LoginView.js";
 import { APP_URL, fetchBalance, fetchProfile, fetchTaskTitle } from "../auth/auth.js";
-import { getAuthToken, loadSettings, saveSettings } from "../config/settings.js";
+import { getAuthToken, getPendingProjectHooks, loadSettings, saveSettings, trustProjectHooks, } from "../config/settings.js";
 import { Agent } from "../core/agent.js";
 import { Spinner } from "./components/Spinner.js";
 import { InputBox } from "./components/InputBox.js";
 import { ApprovalPrompt } from "./components/ApprovalPrompt.js";
 import { FollowupPrompt } from "./components/FollowupPrompt.js";
+import { HookTrustPrompt } from "./components/HookTrustPrompt.js";
 import { StatusBar } from "./components/StatusBar.js";
 import { ModelPicker } from "./components/ModelPicker.js";
 import { SessionPicker } from "./components/SessionPicker.js";
@@ -157,6 +158,9 @@ export function App({ initialView, initialPrompt, initialSession, updateCheck, }
     const [runningTool, setRunningTool] = useState(null);
     const [pendingApproval, setPendingApproval] = useState(null);
     const [pendingFollowup, setPendingFollowup] = useState(null);
+    // Set when the current project defines hooks that haven't been trusted yet;
+    // gates input until the user decides (project hooks run shell commands).
+    const [pendingHookTrust, setPendingHookTrust] = useState(null);
     // FIFO queue of messages the user typed while the LLM was still streaming.
     // Drained one-per-turn on each `turn-end` event so multi-step work can
     // keep flowing without making the user wait for the previous response.
@@ -193,6 +197,10 @@ export function App({ initialView, initialPrompt, initialSession, updateCheck, }
     // we can drain it inside `handleEvent` without re-creating that callback
     // on every keystroke).
     const queueRef = useRef([]);
+    // Holds the startup prompt while we wait for a project-hook trust decision.
+    const deferredPromptRef = useRef(null);
+    // Guards endAndExit against double-invocation (Ctrl+D spam).
+    const exitingRef = useRef(false);
     const enqueueMessage = useCallback((text) => {
         queueRef.current = [...queueRef.current, text];
         setQueuedMessages(queueRef.current);
@@ -220,7 +228,7 @@ export function App({ initialView, initialPrompt, initialSession, updateCheck, }
         void fetchTaskTitle(agent.taskId, token).then((title) => {
             if (title && agentRef.current?.taskId === agent.taskId) {
                 setSessionTitle(title);
-                setTerminalTitle(`${title} (orbcode)`);
+                setTerminalTitle(title);
                 agent.setTitle(title);
             }
         });
@@ -296,6 +304,9 @@ export function App({ initialView, initialPrompt, initialSession, updateCheck, }
             case "completion":
                 pushRow({ kind: "completion", text: event.result });
                 break;
+            case "system":
+                pushRow({ kind: event.isError ? "error" : "info", text: event.message });
+                break;
             case "error":
                 pushRow({ kind: "error", text: event.message });
                 break;
@@ -343,6 +354,7 @@ export function App({ initialView, initialPrompt, initialSession, updateCheck, }
             baseUrl: current.baseUrl,
             autoApproveEdits: current.autoApproveEdits,
             autoApproveSafeCommands: current.autoApproveSafeCommands,
+            hooks: current.hooks,
             resume,
             callbacks: {
                 onEvent: handleEvent,
@@ -363,12 +375,16 @@ export function App({ initialView, initialPrompt, initialSession, updateCheck, }
         resetTranscript();
         setTasks(session.todos ?? "");
         setTotalCost(session.totalCost ?? 0);
+        // Repopulate the status bar immediately. Without this the context
+        // number only appears once the next streaming `usage` chunk arrives,
+        // which can be after several seconds of "ctx 0".
+        setContextTokens(session.contextTokens ?? 0);
         if (session.title) {
             // The stored title is already the backend one (or the prompt
             // fallback); don't re-fetch for this task.
             titleTaskRef.current = session.id;
             setSessionTitle(session.title);
-            setTerminalTitle(`${session.title} (orbcode)`);
+            setTerminalTitle(session.title);
         }
         // Replay the conversation into the transcript.
         for (const message of session.messages) {
@@ -390,6 +406,33 @@ export function App({ initialView, initialPrompt, initialSession, updateCheck, }
         agentRef.current?.setModel(modelId);
         pushRow({ kind: "info", text: `Model switched to ${getModel(modelId).name}` });
     }, [pushRow]);
+    // Fire SessionEnd hooks (best-effort, capped at 3s) before quitting.
+    const endAndExit = useCallback((reason) => {
+        const agent = agentRef.current;
+        if (!agent) {
+            exit();
+            return;
+        }
+        // Guard against double-invocation (e.g. the user spamming Ctrl+D):
+        // the first call schedules the shutdown; subsequent calls are no-ops.
+        if (exitingRef.current)
+            return;
+        exitingRef.current = true;
+        // Clear the cap timer when SessionEnd finishes first — Promise.race
+        // leaves the loser pending, and a ref'd setTimeout would otherwise
+        // keep the event loop alive (delaying the actual exit by up to 3s).
+        let capTimer;
+        const cap = new Promise((resolve) => {
+            capTimer = setTimeout(resolve, 3000);
+            capTimer.unref?.();
+        });
+        void Promise.race([agent.endSession(reason), cap]).finally(() => {
+            if (capTimer)
+                clearTimeout(capTimer);
+            agent.abort();
+            exit();
+        });
+    }, [exit]);
     const handleCommand = useCallback((command) => {
         const [name, ...rest] = command.split(/\s+/);
         const arg = rest.join(" ");
@@ -557,6 +600,9 @@ export function App({ initialView, initialPrompt, initialSession, updateCheck, }
                 break;
             case "/logout": {
                 clearQueue();
+                void agentRef.current?.endSession("logout");
+                setPendingHookTrust(null);
+                deferredPromptRef.current = null;
                 const updated = { ...settings, token: undefined };
                 setSettings(updated);
                 saveSettings(updated);
@@ -565,12 +611,12 @@ export function App({ initialView, initialPrompt, initialSession, updateCheck, }
                 break;
             }
             case "/exit":
-                exit();
+                endAndExit("prompt_input_exit");
                 break;
             default:
                 pushRow({ kind: "error", text: `Unknown command: ${name}. Try /help.` });
         }
-    }, [settings, tasks, contextTokens, totalCost, sessionTitle, exit, pushRow, getAgent, switchModel, resetTranscript, clearQueue]);
+    }, [settings, tasks, contextTokens, totalCost, sessionTitle, endAndExit, pushRow, getAgent, switchModel, resetTranscript, clearQueue]);
     const handleSubmit = useCallback((value) => {
         if (value.startsWith("/")) {
             handleCommand(value);
@@ -592,6 +638,28 @@ export function App({ initialView, initialPrompt, initialSession, updateCheck, }
         setBusyLabel("Thinking");
         void getAgent().runTurn(value);
     }, [settings, busy, handleCommand, enqueueMessage, getAgent, pushRow]);
+    // Resolve the project-hook trust prompt: enable hooks for this workspace (and
+    // the live agent) on approval, then run any prompt we deferred while asking.
+    const resolveHookTrust = useCallback((trust) => {
+        setPendingHookTrust(null);
+        if (trust) {
+            trustProjectHooks(process.cwd());
+            const updated = loadSettings();
+            setSettings(updated);
+            agentRef.current?.setHooks(updated.hooks);
+            pushRow({ kind: "info", text: "Project hooks trusted — enabled for this workspace." });
+        }
+        else {
+            pushRow({
+                kind: "info",
+                text: "Project hooks left disabled. Review .orbcode/settings.json and restart to re-decide.",
+            });
+        }
+        const deferred = deferredPromptRef.current;
+        deferredPromptRef.current = null;
+        if (deferred)
+            handleSubmit(deferred);
+    }, [handleSubmit, pushRow]);
     // Apply --resume and an initial prompt (`orbcode "do something"`) on startup.
     const bootedRef = useRef(false);
     useEffect(() => {
@@ -600,8 +668,16 @@ export function App({ initialView, initialPrompt, initialSession, updateCheck, }
         bootedRef.current = true;
         if (initialSession)
             handleResume(initialSession);
-        if (initialPrompt)
+        // If this project ships untrusted hooks, ask before running anything; the
+        // startup prompt waits until the user decides.
+        const pending = getPendingProjectHooks(process.cwd());
+        if (pending) {
+            setPendingHookTrust(pending);
+            deferredPromptRef.current = initialPrompt ?? null;
+        }
+        else if (initialPrompt) {
             handleSubmit(initialPrompt);
+        }
         refreshUsage();
     }, [initialSession, initialPrompt, handleResume, handleSubmit, refreshUsage]);
     // Resolve the npm version check after first paint so the TUI shows up
@@ -623,8 +699,7 @@ export function App({ initialView, initialPrompt, initialSession, updateCheck, }
         // followup). InputBox swallows other Ctrl-combos, but this hook is a
         // sibling of InputBox's hook, so it still sees the key.
         if (key.ctrl && input === "d") {
-            agentRef.current?.abort();
-            exit();
+            endAndExit("prompt_input_exit");
             return;
         }
         if (key.escape && busy && !pendingApproval && !pendingFollowup) {
@@ -665,21 +740,26 @@ export function App({ initialView, initialPrompt, initialSession, updateCheck, }
         pushRow({ kind: "info", text: `Signed in${who ? ` as ${who}` : ""}. Ready when you are.` });
     }, [pushRow]);
     const taskLines = useMemo(() => tasks.split("\n").map((l) => l.trim()).filter(Boolean), [tasks]);
-    const inputActive = view === "chat" && !pendingApproval && !pendingFollowup && !modelPickerOpen && !resumableSessions;
+    const inputActive = view === "chat" &&
+        !pendingApproval &&
+        !pendingFollowup &&
+        !pendingHookTrust &&
+        !modelPickerOpen &&
+        !resumableSessions;
     return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Static, { items: rows, children: (row) => _jsx(RowView, { row: row }, row.id) }, staticKey), view === "login" ? (_jsx(LoginSection, { onLogin: handleLogin })) : (_jsxs(Box, { flexDirection: "column", children: [updateInfo?.updateAvailable && updateInfo.latest && (_jsxs(Box, { marginTop: 1, flexDirection: "column", borderStyle: "round", borderColor: COLORS.warning, paddingX: 2, alignSelf: "flex-start", children: [_jsxs(Text, { color: COLORS.warning, bold: true, children: ["\u2191 Update available: v", updateInfo.current, " \u2192 v", updateInfo.latest] }), _jsxs(Text, { children: ["Run ", _jsx(Text, { color: COLORS.accent, children: "orbcode update" }), " to install the latest version, then relaunch."] })] })), streamingReasoning && (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsx(Text, { color: COLORS.thinking, italic: true, children: "\u2726 Thinking\u2026" }), _jsx(Box, { paddingLeft: 2, children: _jsx(Text, { dimColor: true, italic: true, children: tail(streamingReasoning, expandReasoningRef.current ? 30 : 3) }) })] })), streamingText && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { children: [_jsx(Text, { color: COLORS.primary, children: "\u25CF " }), streamingText] }) })), runningTool && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: COLORS.warning, children: [formatToolName(runningTool.name), " ", _jsx(Text, { dimColor: true, children: runningTool.summary })] }) })), taskLines.length > 0 && (_jsxs(Box, { flexDirection: "column", marginTop: 1, paddingLeft: 1, children: [_jsx(Text, { dimColor: true, bold: true, children: "Tasks" }), taskLines.slice(0, 10).map((line, i) => (_jsx(Text, { dimColor: /^[-*]\s*\[x\]/i.test(line), children: line
                                     .replace(/^[-*]\s*\[x\]/i, "  ■")
                                     .replace(/^[-*]\s*\[-\]/, "  ◧")
                                     .replace(/^[-*]\s*\[ \]/, "  □") }, i))), taskLines.length > 10 && _jsxs(Text, { dimColor: true, children: [" \u2026 ", taskLines.length - 10, " more"] })] })), modelPickerOpen && (_jsx(Box, { marginTop: 1, children: _jsx(ModelPicker, { currentId: settings.model, onSelect: (modelId) => {
                                 setModelPickerOpen(false);
                                 switchModel(modelId);
-                            }, onCancel: () => setModelPickerOpen(false) }) })), resumableSessions && (_jsx(Box, { marginTop: 1, children: _jsx(SessionPicker, { sessions: resumableSessions, onSelect: handleResume, onCancel: () => setResumableSessions(null) }) })), pendingApproval && (_jsx(Box, { marginTop: 1, children: _jsx(ApprovalPrompt, { request: pendingApproval.request, onDecision: (decision) => {
+                            }, onCancel: () => setModelPickerOpen(false) }) })), resumableSessions && (_jsx(Box, { marginTop: 1, children: _jsx(SessionPicker, { sessions: resumableSessions, onSelect: handleResume, onCancel: () => setResumableSessions(null) }) })), pendingHookTrust && (_jsx(Box, { marginTop: 1, children: _jsx(HookTrustPrompt, { cwd: process.cwd(), commands: pendingHookTrust.commands, onDecision: resolveHookTrust }) })), pendingApproval && (_jsx(Box, { marginTop: 1, children: _jsx(ApprovalPrompt, { request: pendingApproval.request, onDecision: (decision) => {
                                 pendingApproval.resolve(decision);
                                 setPendingApproval(null);
                             } }) })), pendingFollowup && (_jsx(Box, { marginTop: 1, children: _jsx(FollowupPrompt, { question: pendingFollowup.question, suggestions: pendingFollowup.suggestions, onAnswer: (answer) => {
                                 pushRow({ kind: "user", text: answer });
                                 pendingFollowup.resolve(answer);
                                 setPendingFollowup(null);
-                            } }) })), busy && !pendingApproval && !pendingFollowup && !streamingText && (_jsx(Box, { marginTop: 1, children: _jsx(Spinner, { label: busyLabel }) })), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [queuedMessages.length > 0 && (_jsxs(Box, { flexDirection: "column", paddingLeft: 1, marginBottom: 1, children: [_jsxs(Text, { dimColor: true, bold: true, children: ["Queue (", queuedMessages.length, ")"] }), queuedMessages.slice(0, 5).map((msg, i) => (_jsxs(Text, { dimColor: true, children: [i + 1, ". ", truncateForQueue(msg).replace(/\n/g, "↵")] }, i))), queuedMessages.length > 5 && (_jsxs(Text, { dimColor: true, children: [" \u2026 ", queuedMessages.length - 5, " more"] }))] })), _jsx(InputBox, { active: inputActive, slashCommands: SLASH_COMMANDS, onSubmit: handleSubmit }), _jsx(StatusBar, { modelId: settings.model, contextTokens: contextTokens, totalCost: totalCost, state: busy ? busyLabel : "", approvalMode: approvalMode, busy: busy, title: sessionTitle, plan: usage?.plan, usagePercentage: usage?.usagePercentage, tieredUsage: usage?.tieredUsage })] })] }))] }));
+                            } }) })), busy && !pendingApproval && !pendingFollowup && !pendingHookTrust && !streamingText && (_jsx(Box, { marginTop: 1, children: _jsx(Spinner, { label: busyLabel }) })), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [queuedMessages.length > 0 && (_jsxs(Box, { flexDirection: "column", paddingLeft: 1, marginBottom: 1, children: [_jsxs(Text, { dimColor: true, bold: true, children: ["Queue (", queuedMessages.length, ")"] }), queuedMessages.slice(0, 5).map((msg, i) => (_jsxs(Text, { dimColor: true, children: [i + 1, ". ", truncateForQueue(msg).replace(/\n/g, "↵")] }, i))), queuedMessages.length > 5 && (_jsxs(Text, { dimColor: true, children: [" \u2026 ", queuedMessages.length - 5, " more"] }))] })), _jsx(InputBox, { active: inputActive, slashCommands: SLASH_COMMANDS, onSubmit: handleSubmit }), _jsx(StatusBar, { modelId: settings.model, contextTokens: contextTokens, totalCost: totalCost, state: busy ? busyLabel : "", approvalMode: approvalMode, busy: busy, title: sessionTitle, plan: usage?.plan, usagePercentage: usage?.usagePercentage, tieredUsage: usage?.tieredUsage })] })] }))] }));
 }
 function tail(text, lines) {
     const all = text.split("\n").filter((l) => l.trim());

package/dist/ui/components/HookTrustPrompt.js

@@ -0,0 +1,21 @@
+import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
+import { Box, Text, useInput } from "ink";
+import { COLORS } from "../../branding.js";
+const MAX_SHOWN = 8;
+/**
+ * Shown at startup when the current project defines hooks that haven't been
+ * trusted yet. Project hooks run arbitrary shell commands, so they stay
+ * disabled until the user explicitly approves them here.
+ */
+export function HookTrustPrompt({ cwd, commands, onDecision }) {
+    useInput((input, key) => {
+        const lower = input.toLowerCase();
+        if (lower === "y")
+            onDecision(true);
+        else if (lower === "n" || key.escape || key.return)
+            onDecision(false);
+    });
+    const shown = commands.slice(0, MAX_SHOWN);
+    const extra = commands.length - shown.length;
+    return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: COLORS.error, paddingX: 1, children: [_jsxs(Text, { bold: true, color: COLORS.error, children: ["\u26A0 This project defines ", commands.length, " hook command", commands.length === 1 ? "" : "s"] }), _jsxs(Box, { paddingLeft: 2, flexDirection: "column", children: [_jsxs(Text, { dimColor: true, children: [cwd, "/.orbcode/settings.json"] }), _jsx(Text, { children: "Project hooks run these shell commands automatically during the session:" }), shown.map((command, i) => (_jsxs(Text, { color: COLORS.warning, children: ["  • ", command.length > 100 ? command.slice(0, 99) + "…" : command] }, i))), extra > 0 && _jsxs(Text, { dimColor: true, children: [" \u2026 ", extra, " more"] })] }), _jsx(Text, { dimColor: true, children: "Only trust hooks from a repository you trust. (y) trust & enable \u00B7 (n or Enter) keep disabled" })] }));
+}

package/dist/ui/components/StatusBar.js

@@ -33,25 +33,18 @@ function truncate(text, max) {
     return text.length > max ? text.slice(0, max - 1) + "…" : text;
 }
 /**
- * Picks the most constrained window (highest percentage used) and returns a
- * compact string like "5hr 12% · resets in 3h 15m".
+ * Formats the 5hr window as "5hr limit XX% · resets <relative>".
+ * Returns null when tiered usage is unavailable so the line can be hidden.
  */
-function mostConstrainedSummary(tu) {
-    const windows = [
-        ["5hr", tu.fiveHour.percentage, tu.fiveHour.resetsAt],
-        ["wk", tu.weekly.percentage, tu.weekly.resetsAt],
-        ["mo", tu.monthly.percentage, tu.monthly.resetsAt],
-    ];
-    const [label, pct, resetsAt] = windows.reduce((best, cur) => cur[1] >= best[1] ? cur : best);
-    return `${label} ${Math.round(pct)}% · resets ${formatRelativeTime(resetsAt)}`;
+function fiveHourSummary(tu) {
+    if (!tu?.fiveHour)
+        return null;
+    const { percentage, resetsAt } = tu.fiveHour;
+    return `5hr limit ${Math.round(percentage)}% · resets ${formatRelativeTime(resetsAt)}`;
 }
-export function StatusBar({ modelId, contextTokens, totalCost, state, approvalMode, busy, title, plan, usagePercentage, tieredUsage, }) {
+export function StatusBar({ modelId, contextTokens, totalCost: _totalCost, state, approvalMode, busy, title, plan: _plan, usagePercentage: _usagePercentage, tieredUsage, }) {
     const model = getModel(modelId);
     const contextPct = Math.min(100, Math.round((contextTokens / model.contextWindow) * 100));
-    const constrainedLine = tieredUsage
-        ? mostConstrainedSummary(tieredUsage)
-        : typeof usagePercentage === "number"
-            ? `${Math.round(usagePercentage)}% used`
-            : null;
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { justifyContent: "space-between", children: [_jsxs(Text, { dimColor: true, children: [_jsx(Text, { color: approvalMode === "ask" ? undefined : COLORS.warning, children: MODE_LABELS[approvalMode] }), " (shift+tab to cycle)", busy && " · esc to interrupt", state ? _jsxs(Text, { color: COLORS.thinking, children: [" \u00B7 ", state] }) : null] }), _jsxs(Text, { dimColor: true, children: [title ? `${truncate(title, 32)} · ` : "", model.name, " \u00B7 ctx ", contextTokens.toLocaleString(), " (", contextPct, "%)", model.free ? " · free" : ` · $${totalCost.toFixed(4)}`] })] }), (plan || constrainedLine) && (_jsx(Box, { justifyContent: "flex-end", children: _jsxs(Text, { dimColor: true, children: [plan && constrainedLine ? " · " : "", constrainedLine] }) }))] }));
+    const fiveHourLine = fiveHourSummary(tieredUsage);
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { justifyContent: "space-between", children: [_jsxs(Text, { dimColor: true, children: [_jsx(Text, { color: approvalMode === "ask" ? undefined : COLORS.warning, children: MODE_LABELS[approvalMode] }), " (shift+tab to cycle)", busy && " · esc to interrupt", state ? _jsxs(Text, { color: COLORS.thinking, children: [" \u00B7 ", state] }) : null] }), _jsxs(Text, { dimColor: true, children: [title ? `${truncate(title, 32)} · ` : "", model.name, " \u00B7 ctx ", contextTokens.toLocaleString(), " (", contextPct, "%)"] })] }), fiveHourLine && (_jsx(Box, { justifyContent: "flex-end", children: _jsx(Text, { dimColor: true, children: fiveHourLine }) }))] }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@matterailab/orbcode",
-  "version": "0.1.8",
+  "version": "0.1.13",
   "description": "OrbCode CLI — agentic coding in your terminal, powered by Axon models by MatterAI",
   "type": "module",
   "bin": {